Executive brief
GNU Binutils is a set of tools used by developers to manipulate binary executable files. A null pointer dereference vulnerability in the ELF section handler can cause the linker to crash when processing malformed object files during relocation linking. An attacker with the ability to supply crafted binary files could trigger a denial of service by crashing the build process.
Technical details
The vulnerability is a null pointer dereference in the elf_x86_64_common_section_index function (bfd/elf64-x86-64.c:6093) that occurs when the linker processes common symbols during relocatable linking (-r flag). The vulnerable code dereferences a NULL sec pointer and calls elf_section_flags on it without validation. The attack requires local access and the ability to provide a specially crafted object file (PoC available) to the linker. An attacker can trigger a segmentation fault (SEGV) that crashes the linking process. The vulnerability has been patched in binutils 2.48 via commit 7322e9bc30cb282575a701c307851fd3d66fee68.
Affected products
- GNU Binutils 2.47
Timeline
- 2026-07-28: disclosed: Vulnerability reported to Sourceware Bugzilla
- 2026-08-04: patched: Patch committed to master branch (commit 7322e9bc30cb282575a701c307851fd3d66fee68)
- 2026-09-15: advisory: CVE-2026-91781 published